UBUNTU-CVE-2026-93658: High severity ubuntu/rust-coreutils vulnerability
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
uutils coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using uutils coreutils before 0.10.0 are exposed when a privileged user invokes install in an environment where ownership changes can fail because of capability restrictions. The resulting risk is a leftover setuid or setgid executable owned by the privileged invoker.
What does an attacker need to exploit it?
An attacker needs to be able to execute a leftover setuid file created after the ownership-change operation fails. Exploitation depends on a privileged install operation and a capability-restricted system that causes the ownership change to fail.
How can I determine whether a system may already be affected?
Check for uutils coreutils versions earlier than 0.10.0 and review privileged install operations for ownership-change failures. Investigate any resulting destination files that retain setuid or setgid mode and are owned by the privileged user who ran the operation.